That's excatly what we tracked down using network monitor. While normally port 1251 connections are connected to STORE.EXE process, all port 139 connections are talking to the local system process (TCPview is a great tool for examin such stuff).
Sönke Luck KPMG Germany - Messaging Team -----Ursprüngliche Nachricht----- Von: Andrew Hitchcock [mailto:hitchcock@;berbee.com] Gesendet: Freitag, 8. November 2002 18:07 An: Exchange Discussions Betreff: RE: Netbios client sessions for Store access Sounds like the client is falling back to NamedPipes or some protocol other than RPC over TCP -----Original Message----- From: [EMAIL PROTECTED] [mailto:bounce-exchange-97237@;ls.swynk.com] On Behalf Of Chris Scharff Sent: Friday, November 08, 2002 10:43 AM To: Exchange Discussions Subject: RE: Netbios client sessions for Store access Haven't seen it before. Is SP4 on your radar for the Exchange server in question? > -----Original Message----- > From: "Luck, Sönke" [mailto:soenkeluck@;kpmg.com] > Sent: Friday, November 08, 2002 3:18 AM > To: Exchange Discussions > > We've had a strange problem this week, maybe anybody has seen a similiar > thing before. We noticed Outlook clients starting to open Netbios sessions > over port 139 on two of our Exchange servers. Version used are 5.5 SP3 and > Outlook 2000. > > Normally Outlook sends a request on port 135 and gets two ports for DS and > IS access. There are Q articles on this topic, describing how to > configured > this ports to be fixed for configurations for access thru firewalls. All > Exchange servers are configured to use fixed high port numbers 1250 and > 1251 > for DS and IS access at our site. This works fine for a long time, but two > servers stopped using port 1251 for IS access a few days ago. > > We worked on this with PSS, and they found a solution - reboot the servers > ;-)) > > What happened? For some reason, that we - and even Microsoft PSS - didn't > know, on two of our mailbox servers the store process stopped listening on > port 1251. Outlook uses a fallback and opens a Netbios session on port > 139. > Via this connection, all further communication to and from the store is > routed via the system process on the Exchange Server. This works without > any > problems for the clients - as far they can access the server on port 139. > Under normal circumstances this port is not necessary for client access. > > We checked the registered services on the Exchange Server using > rpcdump.exe > and found out that the store is registered correctly on port 1251. > Connection attempts by the clients are rejected immediately. Stopping and > starting the store fixes this behaviour. As mentioned before - we > currently > don't know how we ran into this situation. All server configuration > settings > are correct (and even the same as on all other servers in the site), the > problem only occurred on one location in a time frame where a lot of > network > changes has been done. > > Any comments? > > > Sönke Luck > KPMG Germany - Messaging Team > > > -- > Die Information in dieser eMail ist vertraulich und kann dem > Berufsgeheimnis unterliegen. Sie ist ausschliesslich fuer den Adressaten > bestimmt. Jeglicher Zugriff auf diese eMail durch andere Personen als den > Adressaten ist untersagt. Sollten Sie nicht der fuer diese eMail bestimmte > Adressat sein, ist Ihnen jede Veroeffentlichung, Vervielfaeltigung oder > Weitergabe wie auch das Ergreifen oder Unterlassen von Massnahmen im > Vertrauen auf erlangte Information untersagt. In dieser eMail enthaltene > Meinungen oder Empfehlungen unterliegen den Bedingungen des jeweiligen > Mandatsverhaeltnisses mit dem Adressaten. > > The information in this email is confidential and may be legally > privileged. It is intended solely for the addressee. Access to this email > by anyone else is unauthorized. If you are not the intended recipient, any > disclosure, copying, distribution or any action taken or omitted to be > taken in reliance on it, is prohibited and may be unlawful. Any opinions > or advice contained in this email are subject to the terms and conditions > expressed in the governing KPMG client engagement letter. > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED] -- Die Information in dieser eMail ist vertraulich und kann dem Berufsgeheimnis unterliegen. Sie ist ausschliesslich fuer den Adressaten bestimmt. Jeglicher Zugriff auf diese eMail durch andere Personen als den Adressaten ist untersagt. Sollten Sie nicht der fuer diese eMail bestimmte Adressat sein, ist Ihnen jede Veroeffentlichung, Vervielfaeltigung oder Weitergabe wie auch das Ergreifen oder Unterlassen von Massnahmen im Vertrauen auf erlangte Information untersagt. In dieser eMail enthaltene Meinungen oder Empfehlungen unterliegen den Bedingungen des jeweiligen Mandatsverhaeltnisses mit dem Adressaten. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this email are subject to the terms and conditions expressed in the governing KPMG client engagement letter. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED]
